Critical severity vulnerability - json-schema
- Dominant language
- JavaScript
- Stars
- 39
- Forks
- 15
- PR merge metrics
- No merged PRs in 30d
Description
This package depends on request 2.88.0
https://github.com/avh4/binwrap/blob/main/package.json#L42
Which depends on form-data 2.3.3
https://github.com/request/request/blob/master/package.json#L36
Which depends on json-schema 0.2.3
json-schema 0.2.3 has a critical vulnerability:
https://github.com/advisories/GHSA-896r-f27r-55mw
It would be great if this dependecy could be changed.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with package.json at line 42 and trace the request 2.88.0, form-data 2.3.3, and json-schema 0.2.3 dependency chain described in the issue. Review GHSA-896r-f27r-55mw and confirm the dependency update removes the vulnerable json-schema version.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100